BVwG - W274 2239030-1/12E

BVwG - W274 2239030-1/12E
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4(7) GDPR § 38 AVG
Decided:	03.10.2022
Published:
Parties:	Datenschutzbehörde
National Case Number/Name:	W274 2239030-1/12E
European Case Law Identifier:
Appeal from:
Appeal to:	Unknown
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	Carla von Lueder

The Federal Administrative Court of Austria held that when establishing controllership pursuant to Article 4(7) GDPR, contractual relationships are secondary to the question of who practically influenced the purpose and means of data processing.

English Summary

Facts

The initial complaint was issued by 17 data subjects to the Austrian DPA. It concerned their attendance of a centuries old traditional festival in 2018. The data subjects claimed that during their visit, video material had been taken of them, which contained personal data that was systematically and covertly processed without legal basis or other accompanying safeguards. The data subjects further contested that their right to information had been restricted by the data controllers and processors, since they requested to be sent a copy of their personal data and to restrict further processing in accordance with Article 18(1) GDPR, which was met with the reply that the recordings had been deleted and that the data was not of personal nature due to it only showing persons up to the waist.

The defendants and alleged controllers, of which there were three in total, were in the business of event management, advertising and consultancy. Part of their activities include counting visitor numbers and filtering this information into categories of age and gender. They recorded the visitor numbers at the traditional festival by analyzing the footage of video cameras they set at the entrances.

The defending parties contested the complaint of the data subjects by denying that they were controllers pursuant to Article 4(7) GDPR. They argued that they organized the festival and processed the data of the data subject's on behalf of a contract with the local municipality, who should be deemed the controller.

The municipality, however, had terminated the contract with the defendants for a variety of reasons including, among other things, alleged data protection interferences and disagreements on a visitor count being carried out with video recordings. The defendants were in the process of disputing the validity of the termination in separate civil law proceedings in front of a regional court.

Consequently, the Austrian DPA decided to suspend its decision on a complaint according to § 38 AVG until the regional court had decided in a civil law suit on whether the defendants in the complaint proceedings had acted on behalf of a valid contract with the municipality. The DPA believed that the answer to the question whether a valid contract was in place was an essential preliminary question to establish who the controllers were pursuant to Article 4(7) GDPR.

The data subjects brought in a complaint against this decision by the DPA at the Federal Administrative Court (Bundesverwaltungsgericht Österreich - BvWG). The data subjects argued that the question of who had given the order for data processing by means of video surveillance was only a subquestion in the proceedings in front of the regional court. Consequently, according to Austrian administrative law, these findings could not be binding for the complaint proceedings in front of the DPA.

Holding

The Federal Administrative Court upheld the complaint of the data subjects against the DPA.

According to the court, it became obvious during the various proceedings that the three alleged controllers were in practical control of the data processing. Moreover, it was not clarified in the DPA's decision to suspend the complaint procedure to which extent the three controller’s responsibility would be lessened by establishing whether a valid contract existed. Even by identifying the party who commissioned the visitor count (i.e. potentially the deputy mayor of the municipality), their knowledge or civil mandate would not impact the status as data controllers of the above-mentioned defendants due to their control of the data processing in practice. Therefore, the complaint procedure should not have been suspended.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

REASONS FOR DECISION:

With a complaint to the data protection authority (hereinafter: the authority concerned) on December 20th, 2019, the persons named under 1. to 17. (hereinafter: the complainant, BF), represented by the association to XXXX, turned to the authority concerned with the request ,

1. It wants to be established that those responsible 1. XXXX, 2. XXXX, 3. XXXX (hereinafter: co-participants, MB) violated the BF in their fundamental right to data protection and secrecy by systematically, covertly, identifying and continuously would have processed personal image data of the BF when they visited the XXXX in 2018 without having complied with the principles of lawful processing, in particular by processing their image data without a legal basis, without labeling or other information, without logging, without a data protection impact assessment and without a data protection officer ;

2. determine that the 3rd MB violated the 6th - 11th BF's right to information by not fully complying with their requests for information within the statutory period;

3. determine that the 3rd MB violated the 6th - 11th BF in their right to restriction by not taking any measures to restrict processing;

4. determine that the MB would have violated the BF's right to information;

5. to prohibit the MB from continuing to process personal image data of the BF systematically, covertly, identifyingly and continuously when they visit the XXXX again;

6. instruct the MB with a decision to restrict the processing of the BF's personal image data to exclusive storage for the duration of the procedure, but to transfer it to the BF after it has been determined that it is unlawful and to delete all copies of it remaining with the MB and

7. Impose effective and dissuasive fines on the MB.

In summary, the BF submitted that the municipality of XXXX organizes the XXXX every year, a traditional festival that has been taking place for centuries. The BF would have visited this 2018 on different days. The my 1st - 5th BF are 4, 10, 5 or 3 years old. The 6th - 17th BF and the parents with custody of the 1st - 5th BF had given the representative power of attorney to exercise their rights under Sections 24 to 27 DSG before the data protection authority and the BVwG.

The 1st MB is a company based in XXXX and has the trade license “Organization of events, markets and trade fairs (event management) in accordance with § 5 Para. 2 GewO 1994”. The 2nd MB is the sole shareholder and managing director with sole power of representation of the 1st MB. The 3rd MB practiced as a sole proprietorship the trade "advertising agency according to § 5 paragraph 2 GewO 1994" as well as "business consulting including company organization according to § 94 Z. 74 GewO 1994".

The 3rd MB operates the personal count of affected persons in public space including evaluation as so-called visitor counts and frequency measurements. They offer to filter the data obtained based on people, for example based on criteria such as age or gender.

The 1st MB, represented by the 2nd MB, had commissioned the 3rd MB at an unknown time before the XXXX to collect the visitor numbers of the XXXX XXXX or to provide the 1st MB with such figures and these visitor numbers to be disseminated in the media and to the public. The BF had now learned from the media for the first time that they had been the subject of data processing by those responsible through video surveillance. Their knowledge is based on the statements made by those responsible in media reports in the Kleine Zeitung, the Kronenzeitung, the Bezirksblatt and kärnten.orf.at.

The MB stated that they had installed one or more video cameras or photo cameras at all three entrances to the XXXX for the period from September 29th to October 8th, 2018. These would have recorded the visitors of the XXXX unnoticed between 9 a.m. and midnight, either by means of photos taken at hourly intervals or by means of continuous video recordings. The photo and video cameras were mounted in the air. Children were also counted, even those in prams. The MB had evaluated the recordings by hand and allegedly calculated the number of visitors from 264,830 guests.

The MBs agreed that they had continuously and systematically produced, recorded and evaluated image data of the visitors to XXXX XXXX.

The 6th - 17th BF approached the MB on March 29th, 2019, April 9th, 2019 and April 12th, 2019 with requests for information and asked them to send them a copy of the personal data processed about them and to stop the processing in accordance with Art 18 paragraph 1 previous search term GDPR next search term.

The MB's legal representative replied that he could not give the BF copies of the personal data concerning them because all the recording material had allegedly been deleted. In addition, only recordings of XXXX visitors were made "up to the hip area". Therefore, the evaluation is not personal. In addition, the 3rd MB left the request for information from the 6th - 17th BF unanswered and made no statement about the desired restriction.

The MB had installed hidden overhead cameras, which they used to take either hourly identifying photos or continuously identifying video recordings of the XXXX visitors. The 3.MB personally evaluated them by separating, counting and filtering the people to be seen according to certain criteria and trying to draw appropriate conclusions. There is no legitimate interest conceivable that could justify the admissibility of the image recordings. So far, those responsible have not been able to give any comprehensible reasons for the visitor count carried out. Even if there is a legitimate interest, this would be completely disproportionate. Methods are available for frequency measurement that do not require any processing of personal data, such as manual counting by employees or measurement using thermal imaging cameras. In addition, those responsible would have had to log the processing procedure in accordance with Section 13 (2) DSG, label the hidden cameras and also add a reference to their persons as responsible persons. You would also have had the obligation to inform BF at the time your personal image data was collected in a simple and clearly understandable manner about the content listed in Art. 13 Para. 1 and 2 Previous search term GDPR Next search term. Thus, the MB would have violated information obligations towards the BF. In particular, people who are particularly worthy of protection are also affected, such as children. There were sufficient criteria to qualify as indicators of a high risk for the rights and freedoms of data subjects in accordance with Art. 24, so that the MB would have had to carry out a data protection impact assessment in accordance with Art. 35 Previous search term GDPR Next search term. They would also have had to appoint a data protection officer. In any case, there is unlawful image processing.

Numerous supplements were attached.

In a notification of the status of the procedure dated July 14, 2020, the relevant authority stated that the complaint of December 21, 2019 had been recorded with regard to an alleged violation of the right to secrecy and the obligation to provide information on D 124.1897, relating to an alleged violation of the right to information or to restriction of processing D124.1900.

The subject matter here is therefore only the procedure regarding violation of the right to secrecy and the duty to provide information.

In a letter dated February 24th, 2020, the authority concerned sent the complaint regarding a violation of the right to secrecy and information to the MB for comment.

With a submission dated June 24th, 2020, the BF urged an "immediate handling of the relevant authority" with the attached complaint of December 20th, 2019.

On July 21, 2020, the 3.MB issued a statement through its law-friendly representative, applied for the termination of the proceedings, in eventu a procedure according to § 11 DSG, in particular a warning, and argued that the reason for the complaint was a political and legal dispute that had escalated in the meantime of the municipality of XXXX XXXX about the actual number of visitors and the regional and economic benefits of the XXXX. After the anonymized visitor counts showed that the number of visitors fell well short of expectations, those responsible in politics had to face more and more critical questions in connection with the use of public funds. Furthermore, counting visitors did not bring about the expected strategic success, namely presenting the XXXX as a major event and being able to use it as best as possible for political purposes. This is also reflected in the legal dispute between the XXXX and the 1st MB in the XXXX proceedings of the LG XXXX. In these proceedings, civil law claims would be asserted as part of an extraordinary termination due to alleged data protection violations. The subject of the proceedings is, in particular, whether the municipality of St Veit an der Glan, specifically the deputy mayor and XXXX XXXX wanted the count to be counted and whether XXXX was involved in the process of counting visitors from the start (awarding of contracts, choice of location, invitation to a press conference, etc.). The extent to which this procedure could gain significance for the present procedure cannot yet be conclusively assessed. The facts put forward by the BF were taken out of context and based exclusively on newspaper articles which were not based on an authorized interview but only on assessments by the editors.

The 3rd MB exercised the regulated business of a management consultancy and advertising agency and had been contracted by the 1st MB to count visitors at XXXX. The 1st MB had been commissioned to do this by the municipality of XXXX. The data collected by the 3rd MB was made available to the 1st MB, who was responsible for the sole decision on the use of the data in the contractual relationship. With regard to the contractual relationship between the 1st MB and the municipality of XXXX, the 3rd MB could not provide any information due to lack of knowledge.

Based on these contractual relationships under civil law, the 3.MB is not to be qualified as the person responsible within the meaning of Art. 4 Z. 7 Previous search term GDPR Next search term but as a processor within the meaning of Art. 4 Z. 8 Previous search term GDPR Next search term.

The counting method chosen by the 3.MB using anonymous video recordings is a scientifically recognized method that is customary in the industry. The visitor counts took place anonymously at the three entrances to the XXXX. The video cameras used by the 3.MB were technically set in such a way that they only took pictures from the upper body or the waist down in watered-down image quality, so that the video material did not reveal any natural persons or objects that could be used to indirectly identify such persons suitable, can conclude. The video material only showed the silhouette of a person. The Zerone Mini CMOS CCTV was used as the recording device and the ABUS TVVR30003 digital recorder as the storage medium.

The evaluation and counting was carried out by the 3rd MB using the image data of unidentifiable persons. In addition, the entire video material was irretrievably deleted after evaluation. An age or gender count or an evaluation according to certain criteria had never taken place and would not have been possible with the counting method. The purpose of counting visitors is only to get a realistic picture of the actual number of visitors. The future planning (opening hours, early closing hours, measures to increase the number of visitors) as well as the economic considerations, in particular with regard to the purchase of necessary third-party services and the use of public funds, should then be based on this data material.

It is inexplicable why XXXX now states that it has no connection with the order. This is probably due to political pressure.

There was no violation of the right to secrecy.

On September 14, 2020, the 1st and 2nd MB were again requested to comment. It contained explicit questions, the request to provide specific information on the XXXX procedure and to state what the specific role of the aforementioned Deputy Mayor XXXX was in relation to the cameras and the evaluation of the data in question. Furthermore, photos and comprehensible camera settings had to be submitted and information had to be given on how the information obligation had been fulfilled and whether the cameras had been marked.

With a supplementary statement from the 3rd MB of September 29, 2020, it stated that it could not present any documents on the XXXX procedure of the LG XXXX, that it was only a witness there, that the count was made by the Deputy Mayor and XXXX and XXXX. As deputy mayor and political opponent of the mayor, he wanted to get a better starting position for the upcoming elections.

On October 7th, 2020, the 1st and 2nd MB were again requested to comment under threat of administrative penal proceedings.

According to the memorandum from the relevant authority dated October 16, 2020, the 2nd MB announced to the relevant authority on that day that it had only now received the request via detours. The address in the company register is not correct. An extension of the deadline until November 3, 2020 was granted.

In an e-mail dated November 2nd, 2020, the 2nd MB, as CEO of the 1st MB, commented on the complaint and stated that on August 24th, 2018 he had been commissioned by the Vice Mayor and XXXX by XXXX. The choice of location for the recording devices was also discussed. He also explained that he was responsible for the organizational coordination of the locations and the necessary information. The 3rd MB explained that the recordings/counting would be carried out using anonymous video recordings, due to the unrecognizable/watered down image quality only the silhouettes of people would be reproduced, making it impossible to identify a natural person. “You or he” only acted as sponsors and payers of the bill.

In a letter dated December 13, 2020, the XXXX authority asked for a statement "on its involvement in the subject counting of visitors on XXXX and on the choice of location for the recording devices".

In a statement dated December 3rd, 2020, XXXX , represented by Verdino Funder Sommeregger Rechtsanwälte, stated in summary that in connection with the counting of visitors on XXXX, civil proceedings were pending before the LG XXXX on XXXX, in which the 1.MB appeared as a plaintiff. He joined these proceedings as a secondary intervener on the part of the defendant, the municipality of XXXX. It is incorrect that XXXX, as Vice Mayor and XXXX of the municipality of XXXX, commissioned the 2018 visitor count and chose a location for the cameras. According to § 69 K-AGO, the mayor alone represents the community within the scope of his own sphere of activity. As Vice Mayor, XXXX has no right of representation of any kind. Furthermore, a decision by the XXXX was required for a visitor count, which was not the case. He had repeatedly explained to the 2nd MB and the 3rd MB that the (then) mayor did not want a count and that he therefore could not and would not commission such a count. He had never assumed and had no knowledge that a visitor count would be carried out on XXXX. He found out about the visitor count at the end of February 2019. He took part in a meeting on August 24, 2019 with the 2nd MB and the 3rd MB, the 2018 visitor count was a topic, but XXXX explicitly pointed out that a visitor count from the municipality of XXXX (and also from him) will not be commissioned for the reasons mentioned. The counting of visitors was undisputedly commissioned by the 1.MB

With the contested decision, the authority concerned suspended the procedure pursuant to § 38 AVG “until the decision by the regional court XXXX regarding the procedure XXXX”.

The authority concerned briefly reproduced the arguments of the parties and mentioned the XXXX procedure of the LG XXXX insofar as the 2nd MB stated in its statement of July 23, 2020 that the count had been requested by the vice mayor and XXXX the municipality XXXX. Therefore, a procedure is pending for the mentioned business number of the LG XXXX, which deals with the involvement of the XXXX in the award of contracts, choice of location, etc.

In a submission dated December 3, 2020, XXXX pointed out that the 1st MB in the LG XXXX proceedings mentioned as plaintiff alleges that XXXX had commissioned the subject to count visitors and determined the locations of related cameras, which was not correct.

The authority concerned also made the factual determination that the stated course of the procedure was used as the basis for the factual determinations.

Legally, she explained that the person responsible for processing in accordance with Art. 4 Z. 7 Previous search term GDPR Next search term is the natural or legal person, authority, institution or other body that alone or together with others decides on the purposes and means of processing personal data . The role of the controller would thus primarily result from the fact that a specific body or person decided to process personal data for their own purposes and also decided on the locations of the cameras.

As can be seen from the findings, the subject of the civil proceedings before the LG XXXX on XXXX was the question of who commissioned or decided to count visitors using video cameras and who made the decision about the locations of the cameras in question.

A preliminary question within the meaning of Section 38 AVG could also be a main question in civil proceedings pending at the LG XXXX. You are entitled to suspension.

The question currently pending as part of the civil proceedings mentioned before the LG XXXX, whether a party to the proceedings or a third person commissioned the counting of visitors using video cameras, is essential for the present proceedings, since it is a preliminary question regarding the responsibility for the present video recordings in the sense of Art. 4 Z. 7 Previous search termDSGVONext search term handle, thus a preliminary question according to § 38 AVG.

According to the verdict, the complaints procedure should therefore be suspended until a decision is made in the civil proceedings before the LG XXXX on the above-mentioned GZ.

The complaint of the BF is directed against this decision due to incorrect legal assessment, incorrect findings of fact due to incorrect assessment of evidence and procedural deficiencies with the requests to schedule an oral hearing, in the context of which an on-site inspection be carried out on XXXX and to grant the complaint, in eventu the decision because of the illegality of his content and as a result of violation of the procedural regulations.

A suspension according to § 38 AVG is only permissible if the preliminary question is already the subject of pending proceedings or proceedings to be made pending at the authority responsible for deciding the preliminary question or such a court. The LG XXXX was not called upon to decide on the award of the order to the 3.MB for data processing of the visitor count using video cameras as the main question. The LG XXXX decides on this at most as one of many preliminary questions. The 1st MB sued the municipality of XXXX, which was not involved in the present complaints procedure, to establish the validity of a contract, which the municipality of XXXX had canceled for good cause. The municipality of XXXX has asserted a number of important reasons for dissolution. Only one of them is the 1.MB's breach of data protection law. The subject of the proceedings before the LG XXXX is therefore the authorization to terminate the contract for good cause and not who commissioned or decided to count visitors using video cameras and made the decision about the locations of the cameras. Mere facts and preliminary questions about the existence of a legal relationship could not be the subject of a declaratory action before the civil courts. Because the LG XXXX does not decide on the question as the main question of who gave the order for data processing by video surveillance, any findings made in this regard are not binding in the present complaint proceedings. An administrative authority is not bound by the judgment of a preliminary question by the court. There is no preliminary question if two different acts on rights and obligations have to be issued, which have been issued by different authorities from different points of view.

The question of who commissioned the video surveillance is neither a preliminary question within the meaning of Section 38 AVG nor is it bound by a possible court judgement. In the complaints procedure, the data protection responsibility according to Art. 4 Z. 7 Previous search term GDPR Next search term is decisive, while in the court proceedings the award of orders under civil law is also relevant. The main question in the civil proceedings before the LG XXXX is only whether the termination was justified for good cause. Ultimately, in the relationship between the civil court procedure and the complaints procedure, there is a lack of the identity of the parties required for the binding effect. The 1.MB is indeed identical to the plaintiff in the civil proceedings. Neither the 2nd MB nor the 3rd MB are parties in civil proceedings, nor are they the BF. In contrast, the Municipality of XXXX is not a party to the complaints procedure. Otherwise, the BF would have no way of influencing the outcome of the proceedings in the civil court proceedings, in particular the decision on the responsibility of the MB, due to the lack of party status.

In a brief dated August 31, 2021, the BF submitted the judgment of the LG XXXX of July 30, 2021 on XXXX, which stated that the 1st MB had commissioned the visitor counting via video cameras on XXXX XXXX, and the suspension notice was to be revoked.

With the complaint supplement dated October 20, 2021, further explanations were given on the lack of identity of the parties and the circumstances why the suspension was unjustified.

With a notification dated April 19, 2022, the BF presented the judgment of the Higher Regional Court XXXX on XXXX from XXXX.

With a notification dated May 5, 2022, they also submitted legally binding and enforceable copies of the two judgments of the LG XXXX and the OLG XXXX.

The authority concerned submitted the complaint together with the electronic procedural file - received by the Federal Administrative Court on January 26, 2021 - with reference to the decision and further stated that the main question in the initial proceedings was whether the MB violated the BF's right to secrecy by processing their violated personal data using video cameras. The preliminary question is whether the MB of the initial proceedings had been commissioned under civil law by a representative of the defendant party in the civil court proceedings (Vice Mayor XXXX) to count visitors using video cameras and whether this constituted a legal transaction, whereby the MB lacked the capacity to be responsible. The subject of the civil court proceedings is the question of whether the MB in the initial proceedings (plaintiff in the civil court proceedings) is entitled to damages/warranty, since the cooperation agreement between the two parties had been terminated prematurely. The LG XXXX decides whether a valid contract/order for visitor counting using a video camera was concluded under civil law and whether the early termination of the cooperation agreement was (in)admissible. The BF themselves admit that one of the important reasons for the termination of the cooperation agreement is the data protection procedure of the 1.MB. These "inconsistencies of the BF" could not obscure the fact that the assessment of the question of the civil law assignment is a decisive factor in both proceedings. The decisive factor is who actually ordered the visitor count and is therefore qualified as responsible. The authority concerned does not overlook the fact that the civil court does not have to examine the responsibility under data protection law. This is a matter for the data protection authority. The question of who gave whom a specific (civil law) order for data processing or not has important implications for the initial proceedings before the data protection authority. If it is clear that there was a legal mandate, the representative generally cannot claim responsibility for himself.

The complaint is entitled:

The following facts are established:

With a declaratory action dated July 2nd, 2019, XXXX (1st MB in this proceeding) requested against the municipality of XXXX (represented by attorney Dr. XXXX) that it be determined with effect between the plaintiff and the defendant that the defendant by letter dated May 13, 2019, the immediate termination of the cooperation agreement dated July 4, 2018 was legally invalid and the cooperation agreement continued to exist.

XXXX joined the proceedings as a secondary intermediary on the side of the defendant.

In the proceedings XXXX of the LG XXXX, which were conducted on the basis of this, the plaintiff submitted the following arguments in summary with regard to the legally relevant aspects of these proceedings:

On the basis of the cooperation agreement, the plaintiff was entitled to collect a usage fee for the use of the toilet facilities (am XXXX) that it operates. The defendant undertook to pay the plaintiff a lump sum for the XXXX for making the toilet containers available and for taking over the entire toilet service and for the installation of staff toilet containers. According to the agreement, an early termination of the cooperation agreement is only possible for important reasons, namely if the plaintiff does not fulfill the obligations arising from this agreement, reorganization proceedings are opened against it or it is rejected due to a lack of assets to cover costs, essential hygiene regulations or tax regulations are violated or official regulations are violated Conditions would not be met or if official permits were no longer available.

In a letter from the defendant to the plaintiff dated May 13, 2019, the defendant declared the termination of the cooperation agreement with immediate effect.

Contrary to the view expressed by the defendant, there was no important reason for the immediate termination of the cooperation agreement. The plaintiff carried out the count of XXXX visitors in coordination with Vice Mayor XXXX. The plaintiff was entitled to carry out the visitor count that she had ordered, since this count was necessary in order to obtain realistic and comprehensible numbers, in particular in order to be able to plan the necessary personnel deployment in advance. XXXX as XXXX referent was the sole contact person for the plaintiff. There was never any contact with the then mayor XXXX with regard to the concluded cooperation agreement. Obviously, the plaintiff got caught between the fronts because the then mayor XXXX (SPÖ) got into an argument with his then deputy and vice mayor XXXX (ÖVP) and took the visitor count as an opportunity not only to sell XXXX as a long-standing XXXX and to change the agenda to withdraw, but also to end the cooperation agreement with the plaintiff without reason in order to present and exercise his position of power. XXXX, as the deputy mayor of XXXX, also acted as a representative for the defendant to the outside world, as did the mayor. The rumored number of 500,000 visitors to the XXXX does not correspond to the actual number of visitors.

Years of discussions about the actual number of visitors apparently led to the deputy mayor and XXXX obtaining a written offer from XXXX (3rd MP) on August 14, 2018 for a visitor count. As a result, there was a joint meeting between XXXX, the 2nd MB and XXXX (3rd MB) as managing directors of "XXXX" in the office of the aid organization in XXXX on August 24th, 2018. XXXX knew that the visitor count would be carried out. Apparently he wanted them too. Express consent was not required at all. The defendant also knew about the visitor count. No breach of contract or loss of trust can be derived from the fact that XXXX was involved in the visitor count and informed. XXXX, as XXXX and Deputy Mayor, could have prohibited and prevented such behavior.

The allegation that the plaintiff had not submitted a municipal tax return was incorrect. It is also incorrect that the plaintiff violated official requirements.

The counting of visitors was lawful and permissible and did not infringe on the privacy of XXXX. Incidentally, such an encroachment on the private sphere of XXXX would not be legally enforceable due to the defendant's lack of legitimation. The plaintiff is not responsible for compliance with the legal provisions in the context of visitor counting, but rather the company she has commissioned. XXXX, as the client and payer of the visitor count, did not want any outside help and was quite prepared to protect the deputy mayor. The location of the surveillance cameras was determined exclusively between XXXX and the deputy mayor.

The defendant essentially argued that it was the plaintiff's task to provide the toilet facilities operated by her at XXXX in a functional condition and to operate them with her own staff. The plaintiff had unreasonably impaired and irrevocably destroyed the trust owed from the cooperation. You have violated tax regulations or official tasks and is in arrears with municipal tax returns.

The plaintiff and the 3.MB claimed that they had for the period from 29.09. until 08.10.2018 one or more video or photo cameras are installed at all three entrances of the XXXX. These would have recorded the visitors of the XXXX unnoticed between 9 a.m. and midnight. From this, the 3.MB allegedly could have calculated the number of visitors of 264,830 for the XXXX XXXX on behalf of the plaintiff. At a press conference, the 2nd MB claimed at the time that he was one of the driving forces behind XXXX and that the plaintiff and the 3rd MB had acted without the knowledge and consent of the defendants in general and XXXX in particular. At no time was there any official or private-law approval for counting visitors by means of permanent image data acquisition. No reputable provider of frequency measurements would choose video surveillance as a method with regard to data protection regulations.

The plaintiff violated the defendant's domiciliary rights by failing to obtain their consent to the recording of image data at the entrances to the XXXX XXXX. There were several reasons for the termination of the contract, namely, on the one hand, the loss of trust due to the plaintiff's continued and unfaithful violations of both legal provisions and the contractual duty of protection and care. The plaintiff had permanently destroyed the defendant's trust by installing hidden image capturing devices without the defendant's consent and thus encroached not only on the domiciliary rights but also on the defendant's right to privacy, repeatedly and intentionally ignored data protection regulations, in publicly directed disparaging, defamatory and defamatory statements against the defendant and its representatives against better knowledge without cause and have repeatedly committed competitive actions to the detriment of the defendant etc. It was objectively no longer reasonable for the defendant to maintain the contract with the plaintiff.

XXXX did not agree to video surveillance. Even if the deputy mayor had been involved, he would not have ordered video surveillance either on his own behalf or on behalf of the defendant because he knew that the defendant neither wanted nor needed it and that he was not allowed to commission it. The locations of the video surveillance were not made and determined between XXXX and 3.MB. The visitor count was illegal. If the plaintiff had cooperated with Vice Mayor XXXX, this would have been collusive.

XXXX as a secondary intervener summarized that he had never agreed to the counting of visitors on XXXX XXXX or that he had specified the locations of the surveillance cameras with the 3.MB. The counting of visitors was also not carried out in agreement with him as XXXX.

With the judgment of the LG XXXX XXXX of July 30, 2021, the above-mentioned claim for action was dismissed and, in particular, it was found that XXXX had commissioned XXXX to determine the number of visitors to XXXX in the year XXXX on behalf of the plaintiff.

In the legal assessment, the judge stated that the plaintiff had deliberately carried out or had carried out a visitor count at the XXXX she organized against the will of the defendant, represented by Mayor XXXX. The behavior of the XXXX commissioned by her is to be attributed to the plaintiff. In addition, the plaintiff accused the defendant of having "faked" false visitor payments for years. As a result, the plaintiff acted in bad faith against the will of its contractual partner by having a visitor count carried out on XXXX and communicating the determination of the number of visitors to the public at a press conference. This entitles the defendant to withdraw.

The appeal raised by the plaintiff against this judgment was not followed by the judgment of the Higher Regional Court XXXX on XXXX of XXXX and in the
Reasons for the decision stated that the subject of this lawsuit was the question of whether the defendant municipality was allowed to prematurely terminate a cooperation agreement between it and the plaintiff regarding the operation of the toilet facilities on XXXX for good cause, in particular because the plaintiff had carried out a visitor count.

In the reasons for the decision, the Higher Regional Court XXXX stated that the defendant's mayor had not given a statement of approval (on the count of visitors) and that he had spoken out against it. The managing director of the plaintiff knew about this. There is no room for an apparent power of attorney. The interests of the defendant municipality were adversely affected by the plaintiff's arbitrary action, especially since it was deprived of the opportunity to check compliance with data protection regulations or to decide not to carry out such a count simply because of the appearance of video surveillance of the visitors. The plaintiff initiated the counting of visitors using her access rights to the Wiesemarkt on the basis of the cooperation agreement, knowing that the defendant's representative bodies had the opposite intention.

Both judgments are now legally binding.

The findings are based on the relevant judgments presented by the BF in the course of the proceedings and a confirmation of legal force dated May 5th, 2022.

From this it follows legally:

According to § 38 AVG - unless the law provides otherwise - the authority is entitled to assess questions arising in the preliminary proceedings, which would be the main questions to be decided by other administrative authorities or by the courts, based on their own view of the relevant circumstances and this assessment to base their decision on. However, it can also suspend the proceedings until the final decision on the preliminary question has been reached if the preliminary question is already the subject of pending proceedings at the competent authority or such proceedings are pending at the same time.

A preliminary question in the logical sense is any question whose solution is necessary for the purpose of solving another question. A preliminary question in the legal sense is a legal question for which the authority is not factually competent to answer, but whose solution is an indispensable (necessary) prerequisite for the solution of another question, namely the respective main question (Hengstschläger-Leeb, AVG § 38, Rz 1 mwN).

The preliminary question concept of § 38 AVG (preliminary question in the technical sense) only deals with those preliminary questions that would have to be decided as main questions by other administrative authorities or by the courts. It is sufficient that the other authority has a different “circumstance important to the decision”, i.e. just a “conceptual prerequisite for the assessment” of an element of the offense (as above, margin no. 2).

A preliminary question to be answered by a court would exist, for example, if administrative regulations are linked to ownership of an item (as above, margin no. 4).

There is no preliminary question within the meaning of § 38 AVG if the relevant legal question does not fall within the competence of another authority (a court), i.e. it is not the main question to be decided by any authority (as above, margin no. 6).

A preliminary question constellation also does not exist in the relationship between proceedings in which only the same facts are to be discussed from different points of view (as above, margin no. 8).

A binding effect requires, on the one hand, that the preliminary question decision has also become binding on (all) the parties to the administrative proceedings due to their party status in other proceedings or, exceptionally, due to an extension of legal force (as above, margin no. 23).

Only the verdict of the preliminary question decision can become legally binding, so that only this, but not the reasons for the decision, can have a direct binding effect (as above margin no. 24).

It follows:

It should be stated in advance that the proceedings based on the disputed decision were "suspended until the decision by the regional court XXXX on the XXXX proceedings".

Admittedly, the verdict of a suspension resolution would require clarification "until it becomes final, which decision will be suspended in which specific procedure" (Hengstschläger-Leeb, as above, margin no. 48).

In any case, the presumed reason for suspension would have ceased to exist in the meantime due to the legally binding termination of the proceedings under consideration by LG XXXX. The procedure is (ex lege) therefore in the continuation stage.

Due to the legal effects caused by the suspension, in particular with regard to the decision period of the authority (see § 8 Para. 1 and Para. 2 Z. 1 VwGVG), it can be assumed that the legal interest in a decision regarding the in the past pending suspension has not lapsed.

In its very brief justification, the authority concerned stated that there was a complaint about a violation of the right to secrecy and information because video recordings were made by the respondents at XXXX in the period from September 29, 2018 to October 8, 2018. The second respondent (meaning the 3rd MB) commented that the count had been requested by the Vice Mayor and XXXX of the municipality of XXXX, XXXX, and therefore proceedings were pending at the LG XXXX for GZ XXXX, which dealt with the involvement of the XXXX in the award of contracts through the choice of location. The first respondent (1.MB) stated that the visitor count by means of video recording had been commissioned by the deputy mayor XXXX, who was also responsible for the organization and the choice of location. About the order, he said that he had not commissioned the visitor count. He also refers to the civil proceedings mentioned, in which the 1.MB claimed as plaintiff that XXXX had the ggst. Commissioned visitor counting and determined the locations of the cameras.

“This course of the procedure” is used as the basis for the findings.

Legally, the authority concerned initially referred to the concept of the person responsible pursuant to Art 4 Z 7 Previous search term GDPR Next search term and explained that the role of responsible person resulted primarily from the fact that a specific body or person had decided to use personal data for their to process it for its own purposes and to decide on the locations of the cameras. She further stated that "as would be apparent from the findings", the subject of the civil proceedings before the LG XXXX was the question of who commissioned or decided to count visitors using video cameras and the decision on the locations of the ggst. hit cameras. The question currently pending as part of the civil proceedings before the LG XXXX, whether a party to the proceedings or a third person commissioned the counting of visitors using video cameras, is for the ggst. Procedure essential, since it is a preliminary question regarding the responsibility for the ggst. Video and image recordings within the meaning of Art 4 Z 7 previous search termDSGVOnext search term and thus a preliminary question according to § 38 AVG. Therefore, the proceedings should be suspended until a decision is made in the civil proceedings mentioned.

On the basis of the suspension requirements of § 38 AVG (see the above detailed explanations), the authority concerned justified the decision insufficiently, especially with regard to the fact that it considered the subject matter of the LG XXXX, which in its view was responsible for the decision on a preliminary question, to be extremely inadequate and as a result presented contrary to the records: The assessment of the subject matter of the court whose decision an authority considers responsible for solving the preliminary question requires explicit statements on the subject matter of this proceeding. It remains unclear where the relevant authority obtained its statements on the subject matter of the preliminary proceedings, which can only be qualified as “indications”.

In fact, unless explicitly disclaimed by the parties, these can only be obtained from the pre-litigation file. They were determined here on the basis of the detailed description in the copy of the judgment of the LG XXXX of July 30, 2021, which is now available to the administrative court.

The main subject of the proceedings was the question of whether the cancellation of the cooperation agreement of July 4th, 2018 with the 1.MB declared by the defendant Stadtgemeinde XXXX (which is not a party to the proceedings before the data protection authority) is legally effective. The secondary intervener XXXX, who subsequently joined the proceedings there, is also not a party to the data protection proceedings, although he was questioned in writing by the authority concerned about his role in the subject matter at issue in the proceedings. It is true that the topic of the visitor survey on XXXX XXXX was also part of the alleged and disputed reasons for dissolving the cooperation agreement, but in the light of the findings that have now been made, it is by no means correct that the question "whether a party to the proceedings or a third person counted the visitors by means of video camera” was the pending (principal) issue of the proceeding before the LG XXXX to XXXX.

The subject matter of a civil proceeding is formed by the declarations of the parties and the submissions of the parties.

According to the plaintiff's submissions in the civil proceedings, the question was not at all whether a party to the proceedings or a third person commissioned the visitor counting using a video camera, because the plaintiff herself assumed that she had given this order:

"In any case, the plaintiff was entitled to carry out the count of visitors she had ordered" (judgment page 3 above)"; "an express consent (of the deputy mayor) was not necessary at all" (page 3 below); “It is not the plaintiff who is responsible for compliance with the legal provisions in the context of the commissioned visitor count, but the company commissioned by her” (page 4 below), thus “XXXX as the client and payer of the visitor count” (page 5, 2nd paragraph).

On the basis of this argument, it is not tenable to classify the question of commissioning the visitor count (by whomever) as a subject of civil proceedings.

If the question of XXXX “knowing” had been considered relevant, it would have been up to the authority concerned to deal with the question of the extent to which this (but also with regard to his position as deputy mayor) could have given him any responsibility at all. The authority concerned has also not explained to what extent the possible fact that a third party (XXXX) in agreement with the 3.MB would have taken care of the location of the cameras could have a significant legal significance for assessing the data protection responsibility of the MB .

Based on the regulation of Art. 4 Z 7 previous search term GDPR presented by the authority concerned, according to which the person responsible is the person, authority, institution or body that alone or jointly with others decides on the purposes and means of processing personal data Against the background of the arguments presented, it is not clear to what extent a decision in the civil proceedings mentioned could release the claimed MB from their capacity as responsible. According to the arguments presented by the plaintiff before the LG XXXX, they (the 1st MB) or XXXX (the 2nd MB) “commissioned” the 3rd MB with the visitor count and paid for their services. Even if this had been done "in coordination" or "with the knowledge" of the XXXX, there is no recognizable basis on the basis of which the LG XXXX could have determined "a civil law" order against the 1.MB, which is why the relevant Statements by the authority concerned in the context of the file submission (there S 5) do not apply.

In addition, as shown, only the verdict of the preliminary question decision can have a binding effect on the administrative procedure. However, nothing significant for the administrative procedure can be derived from the ruling, which only deals with the question of the legal validity of the termination of the cooperation agreement of July 4th, 2018.

Overall, taking into account the entire submissions of the parties in the preliminary proceedings, there is no reason for suspension, so that the suspension notice mentioned should not have been issued. It was therefore to be repaired without replacement.

According to § 24 para. 2 no. 1 2nd case of the VwGVG, there was no need for an oral hearing because the file situation shows that the decision was to be remedied without replacement.

The statement of the inadmissibility of the appeal is based on the fact that on the basis of the legal situation and consistent case law on the requirements for a suspension, individual case-related considerations had to be made.

keywords
Suspension of the rectification of the decision Image processing Data protection Data protection complaint Data protection procedure Data processing Elimination without replacement Secrecy Court proceedings Duty to inform Personal data Legal force of the decision Responsible subject of the proceedings Video surveillance Preliminary question
European Case Law Identifier (ECLI)
ECLI:AT:BVWG:2022:W274.2239030.1.00
In RIS since
10/31/2022
Last updated on
10/31/2022
document number
BVWGT_20221003_W274_2239030_1_00